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DETAILED ACTION 

1. The amendment of 09 August 2007 has been noted and made of record. 

2. Claims 1-4 and 6-8 have been presented for examination. 

3. Claim 5 has been cancelled as per Applicant's request. 

Response to Arguments 

4. AppHcant's arguments, see page 7, filed 09 August 2007, with respect to the specification 
have been fully considered and are persuasive. The objection of the specification has been 
withdravra. 

5. Applicant's arguments, see page 7, filed 09 August 2007, with respect to the 35 U.S.C. 
101 rejections have been fully considered and are persuasive. The 35 U.S.C. 101 rejections of 
the claims 6 and 7 has been withdrawn. 

6. Applicant's arguments with respect to claims 1-4 and 6-8 have been considered but are 
moot in view of the new grounds of rejection. 

7. See further grounds of rejection set forth below. 

Specification 

8. The amendment filed 09 August 2007 is objected to under 35 U.S.C. 132(a) because it 
introduces new matter into the disclosure. 35 U.S.C. 132(a) states that no amendment shall 
introduce new matter into the disclosure of the invention. The added material which is not 
supported by the original disclosure is as follows: 

Applications may be stored in computer software storage medium. U.S. Patents No. 
5,966,143; 6,457,171; and 6,606,694, which are herein incorporated by reference, 
describe various embodiments of a computer software storage medium. 



Application/Control Number: 1 0/50 1 ,336 Page 3 

Art Unit: 2131 

9. Applicant is required to cancel the new matter in the reply to this Office Action. 

Claim Rejections - 35 USC §103 

10. The text of those sections of Title 35, U.S. Code not included in this action can be found 
in a prior Office action. 

11. Claims 1-4 and 6-8 are rejected under 35 U.S.C. 103(a) as being unpatentable over U.S. 
Patent No. 6,757,830 Bl to Tarbotton et al., hereinafter Tarbotton, in view of U.S. Patent 
Application Publication 2004/0054498 Al to Shipp, hereinafter Shipp. 

12. As per claim 1, Tarbotton teaches a method of preventing the infection of a computer 
network by a computer virus, where that virus can be spread by e-mail traffic, the method 
comprising: 

installing at an e-mail gateway of the network an anti-virus application, which application 
scans at least incoming e-mail traffic for known viruses (Figures 1 [blocks 8, 10, 12], 2, 3 
[blocks 26, 42], column 5, lines 37-41, column 5, line 59 to column 6, line 3, i.e. mail server 
includes anti-virus and anti-spam system that detects unwanted properties in e-mails); 

a provider of the anti-virus application, sending updates to the anti-virus application 
(Figure 1 [block 14], column 5, line 58 to column 6, line 3); and 

at the anti-virus application, responding to said notification by failing to deliver incoming 
e-mails or their attachments to their recipients within the network (Figure 3 [blocks 32, 34, 36], 
column 6, lines 59-67, column 7, line 21-14, i.e. applying a delay based on e-mail attributes) and 
causing these e-mails or attachments to be re-directed to a buffer for safe storage (Figure 2 
[block 16], column 6, lines 4-14, i.e. dirty mail store); 
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subsequently generating a signature for the virus at the anti-virus application provider and 
providing that signature to the application at the gateway (column 1, lines 37-54, column 5, lines 
41-47, i.e. anti-virus provider create and distribute countermeasures) 

at the gateway, after receiving the signature, using the application to scan the previously 
buffered e-mails or attachments for the virus (column 7, lines 7-13); 

after scanning the previously buffered e-mails, delivering e-mails or attachments which 
are virus free to their recipients (column 6, lines 42-55, i.e. delivering disinfected e-mails). 

13. Tarbotton does not teach when a new virus is detected by the provider of the anti- virus 
application, sending a notification of this event from the provider to the anti-virus-application, 
discontinuing the normal handling of e-mails and resuming the normal handling after appropriate 
actions have been taken. 

14. It would have been obvious to one of ordinary skill in the art at the time the invention 
was made to discontinue the normal handling of e-mails when notified of a new virus and 
subsequently resuming the normal handling of e-mails when appropriate countermeasures have 
been taken, since one of ordinary skill in the art would realize that discontinuing the normal 
handling of e-mails would minimize the damage incurred by a new virus since Tarbotton 
discloses at column 1, lines 37-54 that the speed with which e-mail is distributed an unchecked 
hour can result in dire consequences for the computer systems. Therefore, by discontinuing e- 
mail service temporarily, a skilled artisan would prevent damage to the computer network. 

1 5. Shipp teaches an e-mail server alerting other e-mail servers of new or previously 
unknown viruses (paragraph 0138). 
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16. It would have been obvious to one of ordinary skill in the art at the time the invention 
was made to send notification of a new virus from the anti-virus provider to the anti- virus 
application, since Shipp states at paragraphs 0096 that alerting e-mail gateways of new viruses 
allows them to intercept the viruses, recognize the symptoms, and stop further occurrences 
before the virus becomes too widespread. \ 

17. Regarding claim 2, Tarbotton teaches establishing a communication channel between the 
anti-virus application provider and the anti-virus over the internet (Figure 1 [block 6]). The 
Applicant admits that TCP/IP and UDP/IP are the most common protocols used on the Internet. 

18. Regarding claim 3, Shipp teaches the application provider sending updates to the 
administrator of the application (paragraph 0138, i.e. alert human operators). The Applicant 
admits that it would have been obvious to one of ordinary skill in the art at the time the invention 
was made to send those updates via email. 

19. Regarding claim 4, Tarbotton teaches wherein said notification is sent from the 
application provider to the application as a result of a result of a request or enquiry sent from the 
application to the provider (Figure 3 [block 38], column 7, lines 1-13). 

20. As per claims 6 and 7, Tarbotton teaches an anti-virus application for installation on a 
network server on which is also installed an e-mail gateway, the application being arranged to 
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interact with the e-mail gateway to scan incoming e-mails and/or e-mail attachments for known 
viruses, the application having 

means the application to prevent delivery of e-mails or e-mail attachments received at the 
gateway and to divert these e-mails or attachments to a buffer for safe storage (Figures 2 [block 
16], 3 [blocks 32, 34, 36], column 6, lines 4-14, column 6, Hnes 59-67, column 7, line 21-14, i.e. 
applying a delay based on e-mail attributes and storing the emails in the dirty mail store), and 

means the application to cease preventing delivery of newly received e-mails or 
attachments (Figure 3 [blocks 38, 40], column 7, lines 1-13). 

2 1 . Tarbotton does not teach means for receiving a notification from the provider of the 
application regarding a new virus, and means for subsequently receiving a second notification 
from the provider signaling that the messages should be delivered. 

22. Shipp teaches an e-mail server alerting other e-mail servers of new or previously 
unknown viruses (paragraph 0138). 

23. It would have been obvious to' one of ordinary skill in the art at the time the invention 
was made to send notification of a new virus from the anti-virus provider to the anti-virus 
application, since Shipp states at paragraphs 0096 that alerting e-mail gateways of new viruses 
allows them to intercept the viruses, recognize the symptoms, and stop further occurrences 
before the virus becomes too widespread. 

24. As per claim 8, Tarbotton teaches a method of preventing the infection of a computer 
network by a computer virus, where that virus can be spread by e-mail traffic, the method 
comprising: 
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installing at an e-mail gateway of the network an anti-virus application, which application 
scans at least incoming e-mail traffic for known viruses using a database of virus signatures 
(Figures 1 [blocks 8, 10, 12], 2, 3 [blocks 26, 42], column 5, lines 37-41, column 5, line 59 to 
column 6, line 3, i.e. mail server includes anti-virus and anti-spam system that detects unwanted 
properties in e-mails); 

a provider of the anti-virus application, calculating a checksum for the file carrying the 
virus or a relevant part of that file (column 9, lines 10-23), and sending a notification containing 
the checksum from the provider to the anti-virus-application (Figure 1 [block 14], column 5, line 
58 to column 6, line 3); and 

at the anti-virus application, using the checksum to screen e-mails and/or their 
attachments for the virus until such time as a signature for the virus is received by the e-mail 
gateway from the application provider (Figure 3 [blocks 26, 42], column 5, lines 37-41, column 
5, line 59 to column 6, line 3, column 9, lines 10-23). 

25. Tarbotton does not teach when a new virus is detected by the provider of the anti-virus 
application, sending a notification of this event and a checksum from the provider to the anti- 
virus-application. 

26. Shipp teaches an e-mail server alerting other e-mail servers of new or previously 
unknown viruses (paragraph 0138). 

27. It would have been obvious to one of ordinary skill in the art at the time the invention 
was made to send notification of a new virus from the anti-virus provider to the anti-virus 
application, since Shipp states at paragraphs 0096 that alerting e-mail gateways of new viruses 
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allows them to intercept the viruses, recognize the symptoms, and stop further occurrences 
before the virus becomes too widespread. 

Conclusion 

28. Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Christian La Forgia whose telephone number is (571) 272-3792. 
The examiner can normally be reached on Monday thru Thursday 7-5. 

29. If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Ayaz Sheikh can be reached on (571) 272-3795, The fax phone number for the 
organization where this application or proceeding is assigned is 571-273-8300. 

30. Information regarding the status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 
applications is available through Private PAIR only. For more information about the PAIR 
system, see http://pair-direct.uspto,gov. Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would 
like assistance from a USPTO Customer Service Representative or access to the automated 
information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 



Christian LaForgia 
Patent Examiner 
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